@githolon/dsl 0.107.4 → 0.108.1

package/dart/lib/src/test_harness.dart

@@ -41,13 +41,17 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:crypto/crypto.dart' show sha256;
+import 'package:fixnum/fixnum.dart' show Int64;
+import 'package:nomos_types/nomos_kernel_protocol.dart'
+    show BirthCertificate, BirthOutcomeStatus, SyncWorkspaceResponse;
+import 'package:nomos_types/nomos_types.dart' show Sha256Digest;
 import 'package:package_config/package_config.dart' show loadPackageConfigUri;
 
 import 'dev_cloud.dart';
+import 'application_framework_calls.dart';
 import 'node_runner_transport.dart';
 import 'session_bound.dart' show DomainNotInstalledForSession;
-import 'webview_bridge.dart'
-    show NomosBirthCertificateSpec, NomosBridge, NomosSession;
+import 'webview_bridge.dart' show NomosBridge, NomosSession;
 
 enum _KernelRuntimeArtifact {
   executable('holon.wasm'),
@@ -68,6 +72,30 @@ enum _CandidateKernelBinary {
   final String fileName;
 }
 
+/// Lower the generated protobuf certificate into the framework law's USDA-authored value shape. This is
+/// deliberately not a second certificate type: callers cannot construct it independently, and every field
+/// is read from the compiler-generated message.
+Map<String, Object?> _birthCertificateLawValue(BirthCertificate certificate) =>
+    <String, Object?>{
+      'child': certificate.child,
+      'founder': certificate.founder,
+      'verified': certificate.verified,
+      'parentKey': base64Encode(certificate.parentKey),
+      'parentId': certificate.parentId,
+      'epoch': certificate.epoch.toInt(),
+      'signature': base64Encode(certificate.signature),
+      if (certificate.hasVerifiedVia()) 'verifiedVia': certificate.verifiedVia,
+      if (certificate.hasIdpToken()) 'idpToken': certificate.idpToken,
+      if (certificate.hasCapturedClock())
+        'capturedClock': certificate.capturedClock.toInt(),
+      if (certificate.hasAuthProviderIssuer())
+        'authProviderIssuer': certificate.authProviderIssuer,
+      if (certificate.hasAuthProviderJwks())
+        'authProviderJwks': certificate.authProviderJwks,
+      if (certificate.hasAuthProviderAudience())
+        'authProviderAudience': certificate.authProviderAudience,
+    };
+
 /// A source checkout is itself a coordinated release candidate: compiler, framework packages and kernels
 /// move together. Generated scenarios must not combine those source-generated laws with a recently-written
 /// but older global runtime cache. Published packages have no release/ directory and keep the normal
@@ -104,18 +132,21 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
     if (host == null) {
       throw NomosTestHarnessException('rustc did not report its host target');
     }
-    final result = await Process.run('cargo', [
-      'run',
-      '--quiet',
-      '--target',
-      host,
-      '--manifest-path',
-      '${sourceRoot.path}/tools/kernel-resource/Cargo.toml',
-      '--',
-      'read',
-      '${sourceRoot.path}/release/kernel-candidate.usda',
-      field,
-    ], workingDirectory: sourceRoot.path);
+    final result = await Process.run(
+        'cargo',
+        [
+          'run',
+          '--quiet',
+          '--target',
+          host,
+          '--manifest-path',
+          '${sourceRoot.path}/tools/kernel-resource/Cargo.toml',
+          '--',
+          'read',
+          '${sourceRoot.path}/release/kernel-candidate.usda',
+          field,
+        ],
+        workingDirectory: sourceRoot.path);
     if (result.exitCode != 0) {
       throw NomosTestHarnessException(
         'could not read typed kernel candidate: ${result.stderr}',
@@ -222,36 +253,13 @@ Future<String?> _sourceCandidateRuntime(String nodeEntry) async {
 /// Framework-internal classifier for a sync result that can never become converged by retrying. Generated
 /// scenarios use it through [NomosTestHarness.converge]; it is public only inside `package:nomos_client/src`
 /// so the false-green contract has a cheap regression test without booting a cloud.
-String? nmsPermanentConvergenceFailure(Map<String, Object?> result) {
-  final admission = result['admission'];
-  final sessions = admission is Map && admission['sessions'] is List
-      ? admission['sessions'] as List
-      : const [];
-  final rejected = sessions
-      .whereType<Map>()
-      .expand(
-        (session) => session['rejected'] is List
-            ? session['rejected'] as List
-            : const [],
-      )
-      .toList();
-  final deadLetters = admission is Map && admission['deadLetters'] is List
-      ? admission['deadLetters'] as List
-      : const [];
-  final converged = result['converged'];
-  final replayDeadLetters =
-      converged is Map && converged['deadLettered'] is List
-      ? converged['deadLettered'] as List
-      : const [];
-  final pushError = result['pushError'];
-  final refused = pushError is Map && pushError['refused'] == true;
-  if (rejected.isEmpty &&
-      deadLetters.isEmpty &&
-      replayDeadLetters.isEmpty &&
-      !refused) {
+String? nmsPermanentConvergenceFailure(SyncWorkspaceResponse result) {
+  final transportRefused = result.hasPushError() && result.pushError.refused;
+  if (result.refused == 0 && !transportRefused) {
     return null;
   }
-  return jsonEncode(result);
+  return 'refused=${result.refused}, '
+      'push=${result.hasPushError() ? result.pushError.message : "none"}';
 }
 
 /// The offline-install lane configuration a harness keeps so the CUSTODY DIAGNOSTIC helpers
@@ -311,10 +319,10 @@ class HarnessPhaseTimeout extends NomosTestHarnessException {
     required this.awaiting,
     this.likelyCauses = const [],
   }) : super(
-         'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
-         'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
-         '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}',
-       );
+          'phase "$phase"${workspace != null ? ' (workspace "$workspace")' : ''} '
+          'did not complete within ${elapsed.inSeconds}s while awaiting `$awaiting`'
+          '${likelyCauses.isEmpty ? '' : ' — likely causes: ${likelyCauses.map((c) => '\n  • $c').join()}'}',
+        );
   @override
   String toString() => 'HarnessPhaseTimeout: $message';
 }
@@ -432,16 +440,16 @@ class NomosTestHarness {
     _CloudRestartLane? cloudRestartLane,
     this.testCloud,
     this.homeWorkspace,
-  }) : _sessionNames = List.of(
-         sessionNames,
-       ), // GROWABLE — restoreWorkspace may add a fresh session
-       _devicePublics = devicePublics,
-       _deviceSecrets = deviceSecrets,
-       _lawHashes = Map.of(lawHashes),
-       _snapshots = Map.of(snapshots),
-       _installLane = installLane,
-       _phaseTimeout = phaseTimeout,
-       _cloudRestartLane = cloudRestartLane;
+  })  : _sessionNames = List.of(
+          sessionNames,
+        ), // GROWABLE — restoreWorkspace may add a fresh session
+        _devicePublics = devicePublics,
+        _deviceSecrets = deviceSecrets,
+        _lawHashes = Map.of(lawHashes),
+        _snapshots = Map.of(snapshots),
+        _installLane = installLane,
+        _phaseTimeout = phaseTimeout,
+        _cloudRestartLane = cloudRestartLane;
 
   // ── THE "NO SILENT HANGS" MACHINERY — every lifecycle await runs as a named, deadlined PHASE ──
 
@@ -587,6 +595,7 @@ class NomosTestHarness {
   /// [autoTearDown] — when true (default) and [registerTearDown] is given, registers [dispose] as a teardown.
   static Future<NomosTestHarness> ephemeral({
     required List<String> lawUsdzPaths,
+    NmsApplicationFrameworkCalls? applicationFrameworkCalls,
     int? applicationMaxChildWorkspacesPerUser,
     String? ownerSubject,
     String workspace = 'test-ws',
@@ -609,11 +618,9 @@ class NomosTestHarness {
         'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final effectiveRuntimeDir =
-        runtimeDir ??
+    final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
@@ -626,21 +633,25 @@ class NomosTestHarness {
     //    (default `npx githolon` when the in-repo helper is absent; the test forces this lane by passing
     //    e.g. `installHelper: 'node /abs/cli/dist/cli.mjs'`).
     final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper =
-        installHelper ??
+    final resolvedHelper = installHelper ??
         (File(adjacentInstaller).existsSync()
             ? adjacentInstaller
             : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
         (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-        File(resolvedHelper).existsSync();
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     final owner = ownerSubject?.trim();
-    final birthsApplicationHome =
-        owner != null &&
+    final birthsApplicationHome = owner != null &&
         owner.isNotEmpty &&
         workspace == _receivingGroupNameOf(owner);
+    if (birthsApplicationHome && applicationFrameworkCalls == null) {
+      throw NomosTestHarnessException(
+        'a generated application scenario must pass its compiler-generated framework calls; '
+        'the harness cannot construct domain payloads',
+      );
+    }
     // A receiving-group address is not an arbitrary law-install target. It is valid only when a parent
     // births it with the attestation, signer seating and warrant ordered into genesis. Generated scenarios
     // therefore install their package on a private throwaway application parent and exercise the same local
@@ -662,9 +673,8 @@ class NomosTestHarness {
       final info = await _phased(
         phase: '1/4: offline law install (${lawUsdzPaths.length} package(s))',
         workspace: installWorkspace,
-        awaiting: useInRepoScript
-            ? 'offline-install.ts'
-            : 'githolon harness-install',
+        awaiting:
+            useInRepoScript ? 'offline-install.ts' : 'githolon harness-install',
         timeout: phaseTimeout ?? _kInstallDeadline,
         onDiagnostic: onDiagnostic,
         likelyCauses: const [
@@ -781,53 +791,151 @@ class NomosTestHarness {
           // scenario carries the value from the same package declaration that compiled the
           // receiving-group plan; the harness does not choose or default it. The ordinary
           // seed offer crosses the kernel author gate before the first birth is attempted.
-          run: () => plane
-              .session(installWorkspace)
-              .offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'seedBirthPolicy',
+          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+                call: applicationFrameworkCalls!.seedBirthPolicy(
+                  domain: '__nomos_application_home_v1',
+                  workspace: installWorkspace,
+                  maxBirthsPerPrincipal: maxChildWorkspaces,
+                  setBy: owner,
+                  setAt: bornAt,
+                ),
+                actor: owner,
+              ),
+        );
+        final keyHash = sha256.convert(base64Decode(devicePublic)).toString();
+        await _phased(
+          phase: 'application: seat the verified parent signer',
+          workspace: installWorkspace,
+          awaiting: 'law-declared enrollSigner offer',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+                call: applicationFrameworkCalls!.enrollSigner(
+                  domain: '__nomos_application_home_v1',
+                  workspace: installWorkspace,
+                  keyHash: keyHash,
+                  grantedBy: owner,
+                  grantedAt: 1,
+                  verifiedVia: 'nomos:test-mint',
+                ),
                 actor: owner,
-                authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'maxBirthsPerPrincipal': maxChildWorkspaces,
-                  'setBy': owner,
-                  'setAt': bornAt,
-                },
               ),
         );
+        final delegationCert =
+            await plane.session(installWorkspace).signBirthCert(
+                  BirthCertificate(
+                    child: workspace,
+                    founder: owner,
+                    verified: true,
+                    parentKey: base64Decode(devicePublic),
+                    parentId: 'root',
+                    epoch: Int64.ZERO,
+                  ),
+                  deviceSecret,
+                );
+        await _phased(
+          phase: 'application: record the parent-signed device delegation',
+          workspace: installWorkspace,
+          awaiting: 'law-declared enrollDelegation offer',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+                call: applicationFrameworkCalls!.enrollDelegation(
+                  domain: '__nomos_application_home_v1',
+                  workspace: installWorkspace,
+                  user: owner,
+                  deviceKey: devicePublic,
+                  certificate: delegationCert,
+                  enrolledAt: '1970-01-01T00:00:00.000Z',
+                ),
+                actor: owner,
+              ),
+        );
+        final parentCert = await plane.session(installWorkspace).signBirthCert(
+              BirthCertificate(
+                child: installWorkspace,
+                founder: owner,
+                verified: true,
+                parentKey: base64Decode(devicePublic),
+                parentId: 'root',
+                epoch: Int64.ZERO,
+              ),
+              deviceSecret,
+            );
+        await _phased(
+          phase: 'application: attest and warrant the application parent',
+          workspace: installWorkspace,
+          awaiting: 'typed birth attestation and genesis offers',
+          timeout: phaseTimeout ?? _kOtherDeadline,
+          onDiagnostic: onDiagnostic,
+          run: () async {
+            await plane.session(installWorkspace).offerCallUsdaOutcome(
+                  call: applicationFrameworkCalls!.seedBirthAttestation(
+                    domain: '__nomos_application_home_v1',
+                    workspace: installWorkspace,
+                    child: installWorkspace,
+                    founder: owner,
+                    verified: 'true',
+                    parentId: 'root',
+                    parentKey: devicePublic,
+                    epoch: 0,
+                    links: <BirthCertificate>[parentCert],
+                  ),
+                  actor: owner,
+                );
+            await plane.session(installWorkspace).offerCallUsdaOutcome(
+                  call: applicationFrameworkCalls.seedGenesis(
+                    domain: '__nomos_application_home_v1',
+                    workspace: installWorkspace,
+                    principal: owner,
+                    workspaceId: installWorkspace,
+                    bornAt: '1970-01-01T00:00:00.000Z',
+                  ),
+                  actor: owner,
+                );
+          },
+        );
+        final homeCert = await plane.session(installWorkspace).signBirthCert(
+              BirthCertificate(
+                child: workspace,
+                founder: owner,
+                verified: true,
+                parentKey: base64Decode(devicePublic),
+                parentId: installWorkspace,
+                epoch: Int64.ZERO,
+              ),
+              deviceSecret,
+            );
         final outcome = await _phased(
           phase: 'application: birth the signed-in application',
           workspace: workspace,
           awaiting: 'attested receiving-group birth',
           timeout: phaseTimeout ?? _kOtherDeadline,
           onDiagnostic: onDiagnostic,
-          run: () => plane
-              .session(installWorkspace)
-              .offerOutcome(
-                domain: '__nomos_application_home_v1',
-                directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
+          run: () => plane.session(installWorkspace).offerCallUsdaOutcome(
+                call: applicationFrameworkCalls!.birthReceivingGroup(
+                  domain: '__nomos_application_home_v1',
+                  workspace: installWorkspace,
+                  owner: owner,
+                  frameworkHash: Sha256Digest(framework),
+                  lawHash: Sha256Digest(laws.last),
+                  bornAt: bornAt,
+                ),
                 actor: owner,
                 authorSecret: deviceSecret,
-                payload: <String, Object?>{
-                  'owner': owner,
-                  'frameworkHash': framework,
-                  // Ordered application deployment is reference packages first, deferred child payload last.
-                  // The parent serves the references; the receiving group is born with only its payload law.
-                  'lawHash': laws.last,
-                  'bornAt': bornAt,
-                },
+                birthCertificate: homeCert,
               ),
         );
         String? bornStatus;
         for (final entry in outcome.birthOutcomes) {
-          if (entry['workspace']?.toString() == workspace) {
-            bornStatus = entry['status']?.toString();
+          if (entry.workspace == workspace) {
+            bornStatus = entry.status.name;
             break;
           }
         }
         if (outcome.born.length != 1 ||
             outcome.born.single != workspace ||
-            bornStatus != 'born') {
+            bornStatus != 'BIRTH_OUTCOME_STATUS_BORN') {
           throw NomosTestHarnessException(
             'the offline application parent did not birth "$workspace" cleanly '
             '(born=${outcome.born}, birthOutcomes=${outcome.birthOutcomes})',
@@ -870,19 +978,16 @@ class NomosTestHarness {
             // harness device through the installed framework law with the same verified provenance
             // that the private test root later attests. Production clients never manufacture this
             // marker; it exists only inside the offline test-mint ceremony.
-            run: () => plane
-                .session(workspace)
-                .offerOutcome(
-                  domain: '__nomos_application_home_v1',
-                  directiveId: 'enrollSigner',
+            run: () => plane.session(workspace).offerCallUsdaOutcome(
+                  call: applicationFrameworkCalls!.enrollSigner(
+                    domain: '__nomos_application_home_v1',
+                    workspace: workspace,
+                    keyHash: keyHash,
+                    grantedBy: owner,
+                    grantedAt: 1,
+                    verifiedVia: 'nomos:test-mint',
+                  ),
                   actor: owner,
-                  authorSecret: deviceSecret,
-                  payload: <String, Object?>{
-                    'keyHash': keyHash,
-                    'grantedBy': owner,
-                    'grantedAt': 1,
-                    'verifiedVia': 'nomos:test-mint',
-                  },
                 ),
           );
         } catch (error) {
@@ -890,8 +995,8 @@ class NomosTestHarness {
           // signer route. Preserve their old harness behaviour, while keeping
           // every refusal from a current package fatal.
           if (!error.toString().contains(
-            "no active installed law declares domain '__nomos_application_home_v1'",
-          )) {
+                "no active installed law declares domain '__nomos_application_home_v1'",
+              )) {
             rethrow;
           }
         }
@@ -904,36 +1009,34 @@ class NomosTestHarness {
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'nomosInternalSeedReceivingGroupPolicy7c1f5e',
+              await plane.session(workspace).offerCallUsdaOutcome(
+                    call: applicationFrameworkCalls!.seedReceivingGroupPolicy(
+                      domain: '__nomos_application_home_v1',
+                      workspace: workspace,
+                      setAt: bornAt,
+                    ),
                     actor: 'host-birth',
-                    payload: <String, Object?>{'setAt': bornAt},
                   );
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'nomosInternalSeedReceivingGroup7c1f5e',
+              await plane.session(workspace).offerCallUsdaOutcome(
+                    call: applicationFrameworkCalls.seedReceivingGroup(
+                      domain: '__nomos_application_home_v1',
+                      workspace: workspace,
+                      principal: owner,
+                      workspaceName: _receivingGroupNameOf(owner),
+                      bornAt: bornAt,
+                    ),
                     actor: 'host-birth',
-                    payload: <String, Object?>{
-                      'principal': owner,
-                      'workspaceName': _receivingGroupNameOf(owner),
-                      'bornAt': bornAt,
-                    },
                   );
             },
           );
           final parentCert = await plane.signBirthCert(
-            NomosBirthCertificateSpec(
+            BirthCertificate(
               child: workspace,
               founder: owner,
               verified: true,
-              parentKey: devicePublic,
+              parentKey: base64Decode(devicePublic),
               parentId: 'root',
-              epoch: 0,
+              epoch: Int64.ZERO,
             ),
             deviceSecret,
           );
@@ -944,38 +1047,36 @@ class NomosTestHarness {
             timeout: phaseTimeout ?? _kOtherDeadline,
             onDiagnostic: onDiagnostic,
             run: () async {
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'seedBirthAttestation',
-                    actor: owner,
-                    authorSecret: deviceSecret,
-                    payload: <String, Object?>{
-                      'child': workspace,
-                      'founder': owner,
-                      'verified': 'true',
-                      'parentId': 'root',
-                      'parentKey': devicePublic,
-                      'epoch': 0,
-                      'certChain': jsonEncode(<String, Object?>{
-                        'links': <Object?>[parentCert.toWire()],
-                      }),
-                    },
-                  );
-              await plane
-                  .session(workspace)
-                  .offerOutcome(
-                    domain: '__nomos_application_home_v1',
-                    directiveId: 'seedGenesis',
-                    actor: owner,
-                    authorSecret: deviceSecret,
-                    payload: <String, Object?>{
-                      'principal': owner,
-                      'workspaceId': workspace,
-                      'bornAt': '2000-01-01T00:00:00.000Z',
-                    },
-                  );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'seedBirthAttestation',
+                actor: owner,
+                authorSecret: deviceSecret,
+                payload: <String, Object?>{
+                  'child': workspace,
+                  'founder': owner,
+                  'verified': 'true',
+                  'parentId': 'root',
+                  'parentKey': devicePublic,
+                  'epoch': 0,
+                  'certChain': jsonEncode(<String, Object?>{
+                    'links': <Object?>[
+                      _birthCertificateLawValue(parentCert),
+                    ],
+                  }),
+                },
+              );
+              await plane.session(workspace).offerOutcome(
+                domain: '__nomos_application_home_v1',
+                directiveId: 'seedGenesis',
+                actor: owner,
+                authorSecret: deviceSecret,
+                payload: <String, Object?>{
+                  'principal': owner,
+                  'workspaceId': workspace,
+                  'bornAt': '2000-01-01T00:00:00.000Z',
+                },
+              );
             },
           );
         } on DomainNotInstalledForSession {
@@ -993,9 +1094,9 @@ class NomosTestHarness {
       final sessionLaw = installedHashes.isEmpty
           ? 'installed'
           : (birthsApplicationHome
-                    ? installedHashes.last
-                    : installedHashes.first)
-                .substring(0, 12);
+                  ? installedHashes.last
+                  : installedHashes.first)
+              .substring(0, 12);
       phase('ready — session "$workspace" connected (law $sessionLaw)');
       // THE DECOY SESSION (multi-workspace by default in tests): sole-session inference is how
       // single-workspace assumptions ship — with one session connected, an op that forgot its session
@@ -1125,24 +1226,21 @@ class NomosTestHarness {
         );
       }
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final effectiveRuntimeDir =
-        runtimeDir ??
+    final effectiveRuntimeDir = runtimeDir ??
         Platform.environment['NOMOS_CANDIDATE_RUNTIME'] ??
         Platform.environment['NOMOS_DART_RUNTIME'] ??
         Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
         await _sourceCandidateRuntime(entry);
     final adjacentInstaller = '${File(entry).parent.path}/offline-install.mjs';
-    final resolvedHelper =
-        installHelper ??
+    final resolvedHelper = installHelper ??
         (File(adjacentInstaller).existsSync()
             ? adjacentInstaller
             : '${File(entry).parent.path}/offline-install.ts');
     final useInRepoScript =
         (resolvedHelper.endsWith('.ts') || resolvedHelper.endsWith('.mjs')) &&
-        File(resolvedHelper).existsSync();
+            File(resolvedHelper).existsSync();
     final githolonCmd = installHelper == null ? 'npx githolon' : resolvedHelper;
 
     final workdir = await Directory.systemTemp.createTemp('nomos-cluster-');
@@ -1402,12 +1500,10 @@ class NomosTestHarness {
         'no lawUsdzPaths — pass the build/<name>.law.usdz `npx githolon compile` emits',
       );
     }
-    final entry =
-        nodeEntry ??
+    final entry = nodeEntry ??
         await _resolveEntry(node, resolveFrom ?? Directory.current.path);
-    final bareUid = subject.startsWith('user:')
-        ? subject.substring(5)
-        : subject;
+    final bareUid =
+        subject.startsWith('user:') ? subject.substring(5) : subject;
     final http = HttpClient();
     Future<Map<String, Object?>> post(
       String path,
@@ -1481,8 +1577,8 @@ class NomosTestHarness {
             }
             rethrow;
           }
-          frameworkHash = ((created['controller'] as Map?)?['domainHash'])
-              ?.toString();
+          frameworkHash =
+              ((created['controller'] as Map?)?['domainHash'])?.toString();
           final existing = await get(
             '/v2/workspaces/$platformWorkspace/domains',
           );
@@ -1571,7 +1667,7 @@ class NomosTestHarness {
       );
       final currentLaw =
           (parentDomains['currentLaw'] as Map?)?.cast<String, Object?>() ??
-          const <String, Object?>{};
+              const <String, Object?>{};
       final controlHomeLawHash =
           currentLaw[applicationHomeDomain]?.toString() ?? '';
       if (controlHomeLawHash.isEmpty) {
@@ -1609,8 +1705,7 @@ class NomosTestHarness {
       // restart while offline must not fetch any member before it can replay the persisted ledger. Release CI
       // supplies the exact candidate bundle. An ordinary local test pins all three artifacts advertised by its
       // ephemeral cloud while still online; never combine a candidate kernel with stale framework law.
-      final candidateRuntimeDir =
-          Platform.environment['NOMOS_DART_RUNTIME'] ??
+      final candidateRuntimeDir = Platform.environment['NOMOS_DART_RUNTIME'] ??
           Platform.environment['NOMOS_OFFLINE_RUNTIME'];
       final localRuntime = await Directory(
         '${workdir.path}/client-runtime',
@@ -1630,8 +1725,8 @@ class NomosTestHarness {
               _KernelRuntimeArtifact.controllerLaw:
                   '$candidateRuntimeDir/${_KernelRuntimeArtifact.controllerLaw.fileName}',
             };
-      final hasCandidateBundle =
-          candidateArtifacts.length == _KernelRuntimeArtifact.values.length &&
+      final hasCandidateBundle = candidateArtifacts.length ==
+              _KernelRuntimeArtifact.values.length &&
           candidateArtifacts.values.every((path) => File(path).existsSync());
       if (hasCandidateBundle) {
         for (final artifact in candidateArtifacts.entries) {
@@ -1785,17 +1880,17 @@ class NomosTestHarness {
               'validFromEpoch': 0,
               'grantedAt': DateTime.now().toUtc().toIso8601String(),
               'idpToken': idpToken,
-              'delegationCert': jsonEncode(delegationCert),
+              // The framework law owns this USDA object shape. Keep the
+              // compiler-generated protobuf certificate structured while
+              // lowering it into that domain value; never resurrect the
+              // retired JSON string envelope (`delegationCert`).
+              'delegationCertificate':
+                  _birthCertificateLawValue(delegationCert),
             },
           );
-          final enrollmentSync = await plane.sync(
+          await plane.sync(
             session: platformAuthorSession,
           );
-          if (enrollmentSync['ok'] == false) {
-            throw NomosTestHarnessException(
-              'cloudBound: sealed enrollFirstDevice offer did not converge: $enrollmentSync',
-            );
-          }
           return (
             publicB64: publicB64,
             secret: secret,
@@ -1821,36 +1916,34 @@ class NomosTestHarness {
           // authenticated platform holon mounted. Bind this parent certificate operation to the
           // platform session explicitly; relying on the single-session convenience API becomes
           // ambiguous as soon as the ceremony correctly opens the target workspace in-kernel.
-          final homeCert = await plane
-              .session('$clientId-platform-author')
-              .signBirthCert(
-                NomosBirthCertificateSpec(
-                  child: homeName,
-                  founder: subject,
-                  // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries
-                  // the dev-IdP token, so the gate resolves a VERIFIED founder.
-                  verified: true,
-                  parentKey: device.publicB64,
-                  parentId: platformWorkspace,
-                  epoch: 0,
-                ),
-                device.secret,
-              );
-          final localBirth = await plane
-              .session('$clientId-platform-author')
-              .offerOutcome(
-                domain: applicationHomeDomain,
-                directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
-                actor: subject,
-                authorSecret: device.secret,
-                payload: <String, Object?>{
-                  'owner': subject,
-                  'frameworkHash': frameworkHash,
-                  'lawHash': applicationHomeLawHash,
-                  'bornAt': DateTime.now().toUtc().toIso8601String(),
-                },
-                birthCertificate: homeCert,
-              );
+          final homeCert =
+              await plane.session('$clientId-platform-author').signBirthCert(
+                    BirthCertificate(
+                      child: homeName,
+                      founder: subject,
+                      // The cert's `verified` must MATCH the gate verdict (CAS-as-law): the offer carries
+                      // the dev-IdP token, so the gate resolves a VERIFIED founder.
+                      verified: true,
+                      parentKey: base64Decode(device.publicB64),
+                      parentId: platformWorkspace,
+                      epoch: Int64.ZERO,
+                    ),
+                    device.secret,
+                  );
+          final localBirth =
+              await plane.session('$clientId-platform-author').offerOutcome(
+                    domain: applicationHomeDomain,
+                    directiveId: 'nomosInternalBirthReceivingGroup7c1f5e',
+                    actor: subject,
+                    authorSecret: device.secret,
+                    payload: <String, Object?>{
+                      'owner': subject,
+                      'frameworkHash': frameworkHash,
+                      'lawHash': applicationHomeLawHash,
+                      'bornAt': DateTime.now().toUtc().toIso8601String(),
+                    },
+                    birthCertificate: homeCert,
+                  );
           if (!localBirth.born.contains(homeName)) {
             throw NomosTestHarnessException(
               'cloudBound: the local parent kernel admitted the receiving-group offer but did not birth '
@@ -1860,27 +1953,24 @@ class NomosTestHarness {
           final birthSync = await plane.sync(
             session: '$clientId-platform-author',
           );
-          if (birthSync['pushFailed'] == true ||
-              birthSync['diverged'] == true ||
-              birthSync['stillAhead'] == true) {
+          if (birthSync.pushFailed ||
+              birthSync.diverged ||
+              birthSync.stillAhead) {
             throw NomosTestHarnessException(
               'cloudBound: the sealed receiving-group offer did not converge: $birthSync',
             );
           }
-          final remoteOutcomes =
-              ((birthSync['birthOutcomes'] as List?) ?? const [])
-                  .whereType<Map>()
-                  .map((entry) => entry.cast<String, Object?>())
-                  .toList();
+          final remoteOutcomes = birthSync.birthOutcomes;
           final failedRemoteBirth = remoteOutcomes.where(
             (entry) =>
-                entry['workspace']?.toString() == homeName &&
-                entry['status']?.toString() != 'born',
+                entry.hasWorkspace() &&
+                entry.workspace == homeName &&
+                entry.status != BirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN,
           );
           if (failedRemoteBirth.isNotEmpty) {
             throw NomosTestHarnessException(
               'cloudBound: the remote parent replay refused the receiving-group birth: '
-              '${jsonEncode(failedRemoteBirth.toList())}',
+              '${failedRemoteBirth.toList()}',
             );
           }
           home = homeName;
@@ -1977,7 +2067,7 @@ class NomosTestHarness {
   /// each locally-born child's remote custody BEFORE that child's own sync converges against it. Repeats
   /// until every session reports neither `pushFailed` nor `stillAhead`, or [timeout] (then throws with the
   /// per-workspace last verdicts). Returns the final sync result per workspace.
-  Future<Map<String, Map<String, Object?>>> converge({
+  Future<Map<String, SyncWorkspaceResponse>> converge({
     Duration timeout = const Duration(seconds: 120),
     List<String>? workspaces,
   }) async {
@@ -1988,37 +2078,35 @@ class NomosTestHarness {
     final hw = homeWorkspace;
     if (hw != null && live.remove(hw)) live.insert(0, hw); // the parent leads
     final targets = workspaces ?? live;
-    final last = <String, Map<String, Object?>>{};
+    final last = <String, SyncWorkspaceResponse>{};
+    final lastErrors = <String, String>{};
     final pending = List.of(targets);
     final deadline = DateTime.now().add(timeout);
     while (pending.isNotEmpty) {
       for (final ws in List.of(pending)) {
         try {
-          final r = (await bridge.session(ws).sync(admit: true))
-              .cast<String, Object?>();
+          final r = await bridge.session(ws).sync(admit: true);
           last[ws] = r;
+          lastErrors.remove(ws);
           final permanentFailure = nmsPermanentConvergenceFailure(r);
           if (permanentFailure != null) {
             throw NomosTestHarnessException(
               'converge: $ws rejected or dead-lettered business work — $permanentFailure',
             );
           }
-          if (r['pushFailed'] != true &&
-              r['stillAhead'] != true &&
-              r['offline'] != true &&
-              r['deferred'] != true)
+          if (!r.pushFailed && !r.stillAhead && !r.offline && r.deferred == 0)
             pending.remove(ws);
         } on NomosTestHarnessException {
           rethrow;
         } catch (e) {
-          last[ws] = {'error': e.toString()};
+          lastErrors[ws] = e.toString();
         }
       }
       if (pending.isEmpty) break;
       if (DateTime.now().isAfter(deadline)) {
         throw NomosTestHarnessException(
           'converge: ${pending.length} workspace(s) did not converge within ${timeout.inSeconds}s — '
-          '${pending.map((w) => '$w: ${jsonEncode(last[w] ?? {})}').join('; ')}',
+          '${pending.map((w) => '$w: ${lastErrors[w] ?? last[w]?.toString() ?? "no result"}').join('; ')}',
         );
       }
       await Future<void>.delayed(const Duration(milliseconds: 500));
@@ -2418,14 +2506,14 @@ class NomosTestHarness {
       // transport first makes its incoming stream wait on consumers that can no longer receive their
       // unwatch/done messages—a deterministic teardown deadlock in reactive Flutter tests.
       await _plane.dispose().timeout(
-        _phaseTimeout ?? _kOtherDeadline,
-        onTimeout: () => throw HarnessPhaseTimeout(
-          phase: 'dispose: close bridge watches',
-          workspace: workspace,
-          elapsed: _phaseTimeout ?? _kOtherDeadline,
-          awaiting: 'NomosBridge.dispose',
-        ),
-      );
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
+              phase: 'dispose: close bridge watches',
+              workspace: workspace,
+              elapsed: _phaseTimeout ?? _kOtherDeadline,
+              awaiting: 'NomosBridge.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
         '[nomos-test-harness] bridge dispose error (continuing to runner cleanup): $e',
@@ -2433,14 +2521,14 @@ class NomosTestHarness {
     }
     try {
       await _transport.dispose().timeout(
-        _phaseTimeout ?? _kOtherDeadline,
-        onTimeout: () => throw HarnessPhaseTimeout(
-          phase: 'dispose: stop the node runner',
-          workspace: workspace,
-          elapsed: _phaseTimeout ?? _kOtherDeadline,
-          awaiting: 'NodeRunnerTransport.dispose',
-        ),
-      );
+            _phaseTimeout ?? _kOtherDeadline,
+            onTimeout: () => throw HarnessPhaseTimeout(
+              phase: 'dispose: stop the node runner',
+              workspace: workspace,
+              elapsed: _phaseTimeout ?? _kOtherDeadline,
+              awaiting: 'NodeRunnerTransport.dispose',
+            ),
+          );
     } catch (e) {
       _diag(
         '[nomos-test-harness] transport dispose error (continuing to temp-dir cleanup): $e',
@@ -2574,10 +2662,13 @@ class NomosTestHarness {
       '@githolon/client/runner/node-entry.mjs',
       '@githolon/client/runner/node-entry.ts',
     ]) {
-      final r = await Process.run(node, [
-        '-p',
-        "require.resolve('$entry')",
-      ], workingDirectory: from);
+      final r = await Process.run(
+          node,
+          [
+            '-p',
+            "require.resolve('$entry')",
+          ],
+          workingDirectory: from);
       final out = (r.stdout as String).trim();
       if (r.exitCode == 0 && out.isNotEmpty) return out;
     }
@@ -2610,21 +2701,20 @@ class WorkspaceSnapshot {
 
   /// JSON round-trip so a staged snapshot persists to disk verbatim (the bytes + provenance).
   Map<String, Object?> toJson() => {
-    'workspace': workspace,
-    'snapshotB64': snapshotB64,
-    'head': head,
-    'lawHashes': lawHashes,
-    'capturedAt': capturedAt.toUtc().toIso8601String(),
-  };
+        'workspace': workspace,
+        'snapshotB64': snapshotB64,
+        'head': head,
+        'lawHashes': lawHashes,
+        'capturedAt': capturedAt.toUtc().toIso8601String(),
+      };
 
   factory WorkspaceSnapshot.fromJson(Map<String, Object?> j) =>
       WorkspaceSnapshot(
         workspace: j['workspace'] as String,
         snapshotB64: j['snapshotB64'] as String,
         head: (j['head'] ?? '') as String,
-        lawHashes: ((j['lawHashes'] as List?) ?? const [])
-            .map((e) => '$e')
-            .toList(),
+        lawHashes:
+            ((j['lawHashes'] as List?) ?? const []).map((e) => '$e').toList(),
         capturedAt: DateTime.parse(
           (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
               as String,
@@ -2646,19 +2736,20 @@ class PlaneSnapshot {
   const PlaneSnapshot({required this.workspaces, required this.capturedAt});
 
   Map<String, Object?> toJson() => {
-    'workspaces': workspaces.map((k, v) => MapEntry(k, v.toJson())),
-    'capturedAt': capturedAt.toUtc().toIso8601String(),
-  };
+        'workspaces': workspaces.map((k, v) => MapEntry(k, v.toJson())),
+        'capturedAt': capturedAt.toUtc().toIso8601String(),
+      };
 
   factory PlaneSnapshot.fromJson(Map<String, Object?> j) => PlaneSnapshot(
-    workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
-      (k, v) => MapEntry(
-        '$k',
-        WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
-      ),
-    ),
-    capturedAt: DateTime.parse(
-      (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String()) as String,
-    ),
-  );
+        workspaces: ((j['workspaces'] as Map?) ?? const {}).map(
+          (k, v) => MapEntry(
+            '$k',
+            WorkspaceSnapshot.fromJson((v as Map).cast<String, Object?>()),
+          ),
+        ),
+        capturedAt: DateTime.parse(
+          (j['capturedAt'] ?? DateTime.now().toUtc().toIso8601String())
+              as String,
+        ),
+      );
 }